WordPress Click to Chat – WP Support All-in-One Floating Widget Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Click to Chat – WP Support All-in-One Floating Widget Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49281 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 953e712df67a Credits...

CVE-2024-47766

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictio...

CVE-2024-47766

CVE-2024-47766 affects Tuleap: prior to versions Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, project administrators could access tracker content via the cross tracker search widget despite permission restrictions. The issue is f...

CVE-2024-47766 Permissions are incorrectly verified for project administrators in the cross tracker search widget

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictio...

WordPress AB Categories Search Widget plugin <= 0.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin AB Categories Search Widget versions = 0.2.5...

WordPress ADIF Log Search Widget plugin <= 1.0f - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin ADIF Log Search Widget versions = 1.0f...

WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Wsify Widget versions = 1.0...

Cross-site Scripting (XSS)

limesurvey/limesurvey is is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input validation and output encoding in the Alert Widget's message component...

WordPress Wsify Widget Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Wsify Widget Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-48048 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 8cbe83f02c6b Credits Joshua Chan Required privilege...

WordPress ADIF Log Search Widget Plugin <= 1.0f is vulnerable to Cross Site Scripting (XSS)

Software ADIF Log Search Widget Type Plugin Vulnerable versions = 1.0f Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49238 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 10e10eee4580 Credits Le Ngoc Anh Required privile...

PT-2024-32804

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 15.13.99.110 Tuleap Enterprise Edition versions prior to 15.13-5 Tuleap Enterprise Edition versions prior to 15.12-8 Description Tuleap is a tool for end to end traceability of application and system...

WordPress AB Categories Search Widget Plugin <= 0.2.5 is vulnerable to Cross Site Scripting (XSS)

Software AB Categories Search Widget Type Plugin Vulnerable versions = 0.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49240 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 21eeb86e4dc6 Credits Le Ngoc Anh Required...

CVE-2024-47766: Improper Handling of Insufficient Permissions or Privileges

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictio...

CVE-2024-8902

The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the rendercolumn function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level...

PT-2024-39309 · WordPress · Elementor Addon Elements

Name of the Vulnerable Software and Affected Versions: Elementor Addon Elements plugin for WordPress versions up to, and including, 1.13.8 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data v...

WordPress ShopLentor plugin <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template vulnerability

Authenticated Contributor+ Sensitive Information Exposure via WL: FAQ Widget Elementor Template vulnerability discovered by Ankit Patel in WordPress Plugin ShopLentor versions = 2.9.8...

WordPress pretix widget plugin <= 1.0.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin pretix widget versions = 1.0.5...

CVE-2024-9575 Local File Inclusion in pretix-widget WordPress plugin

Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5...

CVE-2024-9575 Local File Inclusion in pretix-widget WordPress plugin

Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5...

CVE-2024-9575

CVE-2024-9575 : Local File Inclusion in the WordPress plugin pretix-widget (Windows) affects versions 1.0.0–1.0.5. The vulnerability stems from a local file inclusion flaw in the plugin’s handling of input, enabling potential exposure of local files. A fix is available in version 1.0.6 (Patchstac...